The Positive Hack Days — international forum on practical information security.

How much does it take to hack a mobile network?Is electronic government secure
in the era of WikiLeaks and Anonymous?
Is SCADA hacking a Hollywood fiction
or the nowadays reality?Internet banking: is there any chance to win
over the fraudsters?Cyber-crimes, cyber-espionage, cyber-war: where do we draw a borderline?

Pages

Thursday, July 9, 2015

Hot Cyberwar. Hackers and Missile Launchers

The most spectacular contest during PHDays V was the one organized by Advantech. The contest's participants must gain control over an industrial system that controlled a missile launcher and to hit a certain secret object.General

A missile launcher on a turret rotating about two axes, and a target were presented on a stand. The contest's participants must gain control over the industrial system, turn the missile to the target and hit it (breaking down the equipment wouldn't count).

According to the contest's scenario, a hacker bypassed the external perimeter and had access to the office's network segment. Those who connected to the network received the operator's login and password and could watch the system in operation. IP addresses of all the set devices were listed in a table on the stand.

This year's format combined various competitions and capture the flag contests (for more information see our blog). About 40 PHDays attendees and several CTF teams took part in the contest.

Technical details

The SCADA system was deployed on the panel PC Advantech TPC-1840WP and was running on Windows 7 Ultimate without any additional protection systems.

The operating system's updates were installed, Windows firewall was up. The SCADA system was implemented on Advantech WebAccess 8.0.

Since the software could contain unpatched vulnerabilities, the operator's access was limited to visualization of the processes that go on in the controller. The controller's tags were read-only, and rewriting them didn't affect the equipment's operation. With administrator privileges, the attacker could access the page containing description of the system's structure and intrinsic addressing.

Interconnection between the SCADA system and the PLC was maintained via Modbus TCP with the use of pseudoregisters (reading not from I/O modules, but from the controller's program memory ).

In standard mode, client and administrator web access to the SCADA system is available via Internet Explorer through HTML4 using IIS, which is part of a standard Windows distribution kit. By default, authentication is performed by the SCADA system itself.

The physical connection between the SCADA system and the PLC was provided by the L2 managed switch Advantech EKI-7659C with the use of common Fast Ethernet. The connection for contestants was performed through the same switch, via the wire through EKI-4654R or via Wi-Fi through EKI-6351. The switch was not used for VLAN or as a filter for MAC addresses, though it could be used in that way. In addition, the laptop used for managing the stand was connected to the subnetwork.

PLC functions were implemented via the PAC controller Advantech APAX-5620KW, a device based on an ARM processor under WinCE 5. The controller turned the missile launcher due to the timer (for our purpose: it controlled the technological program of the process). For this purpose, the softlogic kernel ProConOs (written by KW Software) was used as a task at the kernel level. The movement program was implemented by the developer in ladder logic by using KW Multiprog. The cycle was 50 msec.

The controller had three standard connection methods: via VGA and USB (unavailable for contestants); via remote desktop (password-protected); via a development system in IEC 61131: it allowed controlling the softlogic subsystem and debug it.

The controller supported two LAN ports, one of which was connected to the SCADA system (the office subnetwork); and the other one, to the input/output modules (the field subnetwork). Network ports had addresses in different subnetworks. This solved the problem of load balancing and separation of access.

For input/output, ADAM-6050 modules (for discrete input from the axes final position sensor) and ADAM-6260 modules were used (for relay control). These modules have the ability of distributed programming in GCL, due to which emergency protection was provided. In particular, when riding into a fin, the DI module reports it to the DO module, and the DO module reversed the appropriate motor for 3 sec. Watchdog that disabled all outputs was installed, in case of communication interruption. The missile actuator control unit's block could be bypassed by recording a logical 1 in a separate internal variable (for which it was necessary to perform a recording function in the Modbus register within the internal subnet).

The physical connection between the modules was performed without the use of an external switch, by using the daisy chain technology in ADAM-6260.
The launcher's turret was supplied by a separate 5 VDC unit and was equipped with three motors (rotation around the vertical and horizontal axis and rocket launch). A relay circuit was used to reverse rotary engines and as zero-level protection against short-circuit in the power unit. In addition, the rocket launcher was equipped with five ground-pressure final position sensors (left, right, up, down, volley performed).

Almost all the components of the system contained non-dictionary (generated) passwords of 8—10 characters that included Latin uppercase and lowercase letters, numbers, punctuation marks.

The battle

The contest lasted for two days during Positive Hack Days.

Day 1

During the first day, contestants mostly examined the external subnet's structure and tried to attack the system via SCADA. The hackers disabled operating system services, including the firewall, managed to foist a new user (without administrator privileges though), restarted the PC twice.

Several participants managed to obtain administrator access to WebAccess by using Windows and SCADA exploits, looked through tag descriptions and had the opportunity to stop the system's kernel. However, the system didn't react to the efforts of rewriting tags; the kernel started automatically via Windows Scheduler. At the end of the day the hackers, exhausted, left an autograph on a page of the system and postponed further efforts till the next morning

Day 2

During the first half of the second day, the contest's participants searched for the source of control signals. One of the participants detected an exploit in WinCE 5, but wasn't able to use it.

At 2 p.m. a hint was given: the controller's external segment is read-only and you could try to "pass" the controller.

At this point RDot (a CTF team) joined. In an hour and a half the team managed to access the remote desktop APAX-5620, gained the opportunity to "kill" and launch the softlogic task and manipulate network adapters.

One of the contestants claimed to have received the opportunity to unidirectional forwarding from LAN1 to LAN2 without receiving return packages. However, Modbus did not allowed using this opportunity for destructive purposes.

At 3 p.m. some mechanical problems occurred on the stand. The contestants gained the opportunity to intercept packages between KW Multiprog and the controller (stop and restart of the controller, enabling the debug mode, the use of the force function with respect to controller memory cells). However, the contestants didn't use this information.

At 4 p.m. participants were provided with program source codes of the APAX and ADAM modules, which could contribute to discovering ways of exploiting regular programs. RDot was noted for the successful attempt of backward reading the program from the controller (this function in KW Software was not password-protected), turning on the debug mode, and monitoring the controller's registers.

At 5 p.m. users were admitted to the internal network; they launched a DDoS attack against the emergency protection system and tried to disable it.

The contest ended at 6 p.m. No one managed to stop the GCL program or to gain control over the outputs, although there were signs of impact on the modules' firmware.

Prize-winning participants were determined due to the points they gained:

1st place: Artur G. from the team Rdot (for hacking the APAX remote desktop, successful work with the source code in IEC61131),

2nd place: Pavel I. (the first one to gain administrator access to the SCADA system's interface),

Most intruders do not know much about ICS specifics. Participants mainly performed attacks (against ports) or used methods that did not comply with the system's features (monitoring Modbus traffic via Wireshark). However, it is possible to study the system's structure and its standard operation.

The most vulnerable are those components that are the closest to the operator interface: SCADA client input, remote desktops. For systems based on Windows, additional software is required to protect both computers (firewalls) and communication channels (encryption).

An enterprise bus and fieldbus must be physically isolated from each other at least by a device with two network cards. Using VLAN is not always effective because of vulnerabilities in web interfaces pf switches.

Its a great pleasure reading your post.Its full of information I am looking for and I love to post a comment that "The content of your post is awesome" Great work http://collegeburden.com/assignments-help-new-zealand

It is a well-maintained site where people can learn about various topics. I am looking forward to read more blogs from here. Students finding it tough to write an assignment can try our online assignment help and can get their coursework written by assignment experts. Assignment Help

This really helps me to find the answers to my question. Hoping that you will continue posting an article having a useful information. Thanks a lot ! this is useful article i like it.Canada Assignment Help

Good idea about cyberwar hackers and missiles and I have read in a research paper published by a dissertation writing service that Russia is expanding its cyber hackers group and making a part of its army.

Well done! It is one of the very informative blogs I have come across. You have a flair for writing and have fine knowledge of the topic as well. Students finding it tough to write their academic assignments could use our Assignment Help and can get a first class coursework written from us.

It is good to see such a helpful website! It has informative as well as interesting articles. I look forward to visit this site again and again. Students with the assignment writing problem could visit our site and can opt for our assignment writing service .

Students could often find it tough to write their academic tasks. It could lead to they not getting desired grades in the academics. Opting for our Assignment Help could be ideal for such students and they can get a complete assignment solution from us.

As we know everyone wants to read useful information, likewise you share this excellent information here along with i am glad to share assignment service which is providing by "Take Assignment Help" company. Company is already working for needy students who are really looking such source.

I am glad to have visited this site. It is a well-designed site and also contains useful information for the visitors. We are a web portal where students check & write reviews for assignments related websites. Here you can check Allassignmenthelp.co.uk reviews.

Congrats on having such well managed site! It has good looks and contains informative content as well. We are an online platform where students check & write reviews for assignments related websites. Here you can check Allassignmenthelp reviews..

Thanks for this web portal. It contains the information i was searching for and you have also explained it well. We are a website where students check & write reviews for assignments related websites. Here you can check Allassignmenthelp.com reviews. .

Very Nice Post Thanks for sharing such an informative information on your blog, Kindly watch my work and get free antivirus in India, the top rated antivirus that provides free real protection from trojan viruses. I will definitely share this on social media platforms.

TNBSE is mainly referred to as Tamil Nadu Board of Secondary Education and it was developed in the year of 1911. For your information, TNBSE is mainly trying to develop the learning and education system in the state of Tamil Nadu with the scheduled classes.

Awesome Content written.I guess writer has done good research on this topic and has written it very well.Have you ever thought on buying a good antivirus for your computer?download malware crusher.Also in order to clear the IAS exam join the best IAS coaching institute jaipur.

All Assignment Help reviewA superior all assignment Help reviews offered by this website with the advantage of online support with high proficiency level based on its latest research and information by professional reviews writers. Wide ranges of subjects are covered with separate writers for each subject.

Hugely appealing text. I have learnt quite a lot on the topic. Can’t wait to share it with my friends online.

Also, take out some time and share your thoughts on Falcon Super Cleaner. It is my work on a free Phone Cleaner & Cache Cleaner – Fast Speed Booster app available on the Play Store. The application features a Junk Cleaner, Phone Booster, Battery Saver, Duplicate Photos Cleaner, Antivirus for Android etc. all blended into one.

AllAssignmentHelp Provider is helping students especially in usa in getting brilliant quality reviews writing USA, essays and dissertations.We at Top Quality Assignment believe that there is no shortcut to success and to attain success, hard work, dedication, and commitment must be present.AllassignmentHelp.co.uk Reviews best in writing unique Assignment.

A superior allassignmenthelp Reviews offered by this website with the advantage of online support with high proficiency level based on its latest research and information by professional reviews writers to get best all assignment help.

All Assignment Help online is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expert’s consultation is also available for students. If they have any query they can contact with our experts anytime.

This makes students like you aware of websites offering low quality All Assignment Help review In this way the precious amount you are about towaste on fraudulent websites will be saved. You can go through all thewebsitesreviewed at BEST WRITERS REVIEWS keeping in mind that it took us so long to check and analyze the services, advantages and drawbacks of particular sites. We are sure after reading the reviews on our site, every student can make a wise decision regarding choosing a good academic writing website.

Thank you very much for sharing this very useful information, I am very happy to have found this information that I have been looking for this long time. We also provide blog My Assignment Help Australia.

Thank You So Much For providing the important and Knowledgeable information.I am Olivia Crew, SEO Expert in a reputed company livewebtutors. All of your information is very useful to me. I am working as an academic consultant in Australia and offer Excellent Assignment Help Services to college students. visit here:- my assignment help

Lots of people could take your website as an example when it comes to the maintenance and content. At times, students could not be able to work on their academic assignments. Our online Assignment help could come handy to you in such circumstances and you can get your assignment written from qualified experts.

Thank You So Much For providing the important and Knowledgeable information.I am Olivia Crew, SEO Expert in a reputed company livewebtutors. All of your information is very useful to me. I am working as an academic consultant in Australia and offer Excellent Assignment Help Services to college students. visit here:- my assignment help

I really happy found this website eventually.. Really informative and inspirative !!Thanks for the post and effort ! Please keep sharing more such article. I've really like your blog and inspire me in many ways We have already set a high standard for coursework help.visit here:- coursework help

This article is very good, infect it’s good to find such a useful content on your website. For education purpose you can look forward to the Programming Assignment Help .Our assignment experts works hard to live up to the expectations and provide total peace of mind

Assignmentservicerating is best reviews site.We at Top Quality Assignment believe that there is no shortcut to success and to attain success, hard work, dedication, and commitment must be present.AllassignmentHelp.co.uk Reviews best reviews site.

Goodness, cool post. I"d like to compose like this as well – requiring significant investment and genuine diligent work to make an incredible article… yet I put things off an excessive amount of and never appear to begin. Much obliged however. Assignment help | Online Assignment help

I am really impressed with you for the selecting of a new and unique topic and also the well-written blog on it. Thanks for sharing with us. We also provide blog Management Assignment Help services in Australia.

Some of these information are really amazing. Thank you for giving me good information. We provide Cheap Assignment Help writing services Australia, Sydney, Melbourne, Brisbane, Adelaide and Perth at lowest prices for university and college students.

I am very happy to read this. This is the kind of manual that needs to be given and not the random misinformation that’s at the other blogs. Appreciate your sharing this best posting. Accounting Assignment Help NZ

Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. brass lion

Students Assignment Help provide assignment help Ireland contribute to the students which clarify their assignment concepts and offers proper guidance about assignments and projects related to the academic discipline.

Students Assignment Help is always ready to give you best services so you will get the best Assignment Help Marketing that will help you know what kind of works we are offering. We offer reasonable assignment writing to our students.

Thank You So Much For providing the important and Knowledgeable information.I am Olivia Crew, SEO Expert in a reputed company livewebtutors. All of your information is very useful to me. I am working as an academic consultant in Australia and offer Excellent Assignment Help Services to college students. visit here:- my assignment help

I really happy found this website eventually.. Really informative and inspirative !!Thanks for the post and effort ! Please keep sharing more such article. I've really like your blog and inspire me in many ways We have already set a high standard for coursework help.visit here:- coursework help

I am Ted Johnson, SEO Expert in a reputed company ukdissertationhelp .I would like to offer you guys tons of thanks for the detailed information and most importantly the information about the marketing strategies is top notch. visit here:- Dissertation Help

I really happy found this website eventually.. Really informative and inspirative !!Thanks for the post and effort ! Please keep sharing more such article. I've really like your blog and inspire me in many ways We have already set a high standard for coursework help.visit here:- coursework help

I am happy to find this post very useful for me, as it contains lot of information. I always prefer to read the quality content and this thing I found in you post. Thanks for sharing. Visit here: Assignment Help

in the case of a subject like math homework help to make homework time tedious. But, there are ways by which you can turn your boring homework into an exciting one. Sounds impossible? It is not. Continue reading to know more.

I am really impressed with you for the selecting of a new and unique topic and also the well-written blog on it. Thanks for sharing with us. We also provide blog My Assignment Help services in Australia.

Excellent information on your blog, thank you for taking the time to share with us. Amazing insight you have on this, it's nice to find a website that details so much information about different artists. visit here:- my assignment help

Quick Shortcut Maker APK is developed by sika524. This app helps us to make shortcuts of the various settings on your home screen. With the help of this app, you can search for the app that you wanted to open.

Students Assignment Help caters the best help with economics assignments services to the students at an affordable price. Our writer provides the best quality assignment writing so that students can score good results in their college and university. You can reach us through email for any academic help info@studentsassignmenthelp.com

Thanks for sharing high value and very informative article with us. And I think this article is very helpful for everyone. You possibly cannot understand all these without taking law assignment help from experts in Singapore.

cycle it is important to know what it is all about. It is basically an educational model for nursing students to understand how to handle a patient who is ‘at risk’. A systematic way can help the nursing students to handle the patients who are at risks and also there will be an appropriate intervention.

Myassignment help provides the best assignment help for all students in Australia. Our professional expert writers provide academic assistance services to all students. Students can get help from our assignment online writers 24*7. For more offers visit Myassignment Help now.

Great post! I am actually getting ready to across this information, is very helpful my friend. Also great blog here with all of the valuable information you have. Keep up the good work you are doing here.

It is good to read such a valuable information and thanks for sharing it. Livewebtutors is striving towards creating a great learning platform and hence, provide authentic Essay writing help to make it more informative.

StudentsAssignmentHelp.com is the best them that is continue giving the best assistance to learners in all the academic disciplines and make sure we are continue giving the best solution for all your questions. To get your work finish well Students Assignments Help services are the best option among students. There are lots of assignment writing websites working online.

I am happy to find this blog very useful for me. As it contains lot of information. I always prefer to read the quality content and this thing I found in you post. Thanks for sharing. We also provide CDR Report .

Get professional help from students assignment help for case study solutions. We provide the reliable help service in the industry for the students. Our writers are perfect in writing coursework assignment. Contact us at info@studentsassignmenthelp.com

My Assignment Services is a well-established and prominent name in providing high-quality assignment help online to students since almost a decade. You can trust our academic ghostwriters completely to get best quality write-ups including case studies, research proposals, dissertations and theses, and more. It is the best assignment help Adelaide provider.Students should always keep themselves ready to meet the university requirements in order to achieve good grades, moreover, they prefer attending lengthy classes instead of writing assignments. Students who are not comfortable with writing assignments can avail university assignment help by buy assignment at My Assignment Services comparatively low prices.

Online Assignment Expert is an academic help service which caters to the needs of students in Australian universities. We provide Online Assignment Help for various documents such as case studies, CDR, essays, thesis, reports, etc. powered with a team of writers who are experts in their fields and cover various subjects.

You can also avail value added services like Nursing Assignment Help, Law Assignment Help, Assignment provider, Management Assignment Help expert consultation, one-to-one sessions with our experts, proofreading, and quality checking free of cost! Moreover, assignments written by us are plagiarism-free, with a Turnitin report provided along with it. We guarantee 100% customer satisfaction through our services.

Being a student in Ireland is difficult as you need to accomplish various assignments within the given deadline. However many assignment writing companies are working to present you with the Students Assignment Help Ireland services. StudentsAssignmentHelp.com is one among them that are continue giving the best guidance ever.

It’s always nice when you can not only be informed, but also entertained! As you study to challenge the human limits & achieve your aims in life at Melbourne, you may at times get stuck & may need to seek Assignment Help Melbourne.

MyAssignmentServices strives to meet the higher education standards of the university through the best quality assignments when you require assignment help. Assignments are written logically and all errors are corrected for a flawless finish in our assignment help service online. When you choose our online assignment help service, you need to think about the quality and your grades as well. On taking assignment help service online from us, you will never get a paper that we have written before or matches any other person's work. Every word in the assignment is written and content is composed of the resources that are collected as evidence in support of the argument. There is no risk of plagiarized content when you avail our online assignment help service. We guarantee the original content and flawless work. We guarantee the original content and flawless work. Professors of the reputed Australian universities consider assignments to be the most efficient method to assess a students’ writing calibre along with their understanding of the course. With the help of online assignment provider, securing an HD grade does not seem impossible for the students.

Amazing website to peruse and share,each and each line in your blog is special and mind blowing exceptionally hard to compose such sort of article on the grounds that so much data is accessible on web and to discover great one among them is a troublesome undertaking.

I invest hours on web and after an excessive amount of diligent work I arranged a blog which will shaken you mind on the off chance that you read it.please see my page:- What is Love

Seeking for assignment help ? Get best My assignment help in Australia by 4500+ Australian experts. Our My Assignment Help Service is plagiarism-free UPTO 30% OFF in Australia. We My Assignment Help Australia can help you with your assignment. My Assignment Services is the best online finance assignment help service provider in Australia. Apart from this, they take part in extra-curricular activities to decrease the level of academic pressure. But, that makes them miss their deadlines resulting in low scores. That’s when assignment help Adelaide is one of the options to look out for. They feel completely pressurized. He starts disliking his school or college. But may come, he has to submit his assignment before the deadline, therefore he chooses to buy assignment services available to him. To help students complete their assignments My Assignment Services is here to serve them with the best assignment help.

Thank you for posting such a great blog! I found your website perfect for my needs. It contains wonderful and helpful posts. Keep up the good work. Thank you for this wonderful Blog!Visit: Homework Help

Hey, I am Olivia Crew as an “Academic Writer” in Livewebtutors.The above post has given reliable and genuine information about Assignment Help Australia. Looking forward to avail their eminent services.visit now:- Assignment Help

Stunning site to scrutinize and share,each and each line in your blog is extraordinary and mind blowing extraordinarily difficult to make such deal with of article because so much information is available law coursework writing on web and to find awesome one among them is a troublesome endeavor.

If you have never used assignment solution from MyAssignmenthelp.com, and wondering “Is Myassignmenthelp legit”, you need to go through the MyAssignmenthelp reviews that are posted by the students. Those reviews offer a proper insight into the services of MyAssignmenthelp.com and let you know if MyAssignmenthelp is a genuine assignment help provider or not.

I would like to take out time to thank you for this wonderful information! I have found an exceptionally well written article on best gym in Jaipur, a must read. Though, this information has proven to be vital for me, keep up the good work. ink361

StudentsAssignmentHelp.com is the best website which is offering assignment writing services for students worldwide. Our Student Assignment Help services is always open at low price as we know students cannot afford to pay a high cost and work submitted well before the deadline.

I am very happy to read this. This is the kind of manual that needs to be given and not the random misinformation that’s at the other blogs. Appreciate your sharing this best posting. marketing assignment help australia

Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. brass handicrafts

TCS Webmail: Latterly, Tata Consultancy Services has intinerated its Webmail on a VPN. At present, it is troublesome to access webmail tcs in your PCs & Mobiles out of the TCS consortium. If you are here to find an easy way to access your TCS Webmail on your

How to write a lab report explains and analyzes a laboratory experiment. So writing a lab report gives the opportunity to pen down the understanding of a student from an experiment done in the laboratory. It expresses what students have done in the experiment, and what you have learned from it.